AsrielNetworksIndirect prompt injection
Instructions planted in content the model will read later: a web page, a document, an email, a tool result.
Definition
Indirect prompt injection places the malicious instruction in content the model will consume later rather than in the conversation: a web page it browses, a document in a retrieval corpus, an inbound email, a calendar entry, a file name, or the result returned by a tool. The attacker never talks to the model; they wait for the application to fetch what they planted.
This is the form that matters for agents. An assistant that reads untrusted content and can also act (send mail, call an API, write to a repository) can be steered by anyone who can get text in front of it. The trust boundary is not between user and model but between the model and every source it reads.
How it manifests
- A retrieved item that contains instructions: a document chunk, page or tool result flagged with
contains_instructionsor a low trust level. - A sensitive action shortly after: within the same trace the agent proposes or executes a tool call the task did not call for, often against a destination the injected text named.
- Invisible carriers: white-on-white text, HTML comments, zero-width characters, metadata fields, alt text, a PDF's hidden layer.
- Repeated persistence: the same poisoned source appears in many sessions, each with a small chance of success.
How AsrielNetworks detects it
The indirect rule correlates events across a trace: an untrusted retrieval or tool result carrying suspicious instructions, followed by a tool proposal, authorization request, denial or execution that is sensitive. It reports whether the influence was only attempted or confirmed by an executed effect. Because retrieval poisoning is the usual carrier, the RAG rule fires alongside it when the source was a corpus document.
- Indirect prompt injection
ai.prompt_injection.indirect· high
Untrusted retrieved instructions correlated with a later sensitive tool proposal in the same trace. - RAG poisoning or contamination
ai.rag.poisoning· medium
A suspicious retrieved document, distinguished from confirmed influence over a risky action.
References
- Greshake et al., Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection (2023).
- MITRE ATLAS, AML.T0051.002 LLM Prompt Injection: Indirect.
- OWASP GenAI Security Project, LLM01:2025 Prompt Injection.
- Willison, Prompt injection series, ongoing analysis of real incidents.